http://www.citi.umich.edu/u/provos/systrace/linux.html
Anybody, seen/use systrace on FC? What are your thoughts about using/adding it to FC?
From reading a bit about it, looks to be a very good/useful tool and
was wondering what others thought about it?
On Mon, 2005-01-17 at 21:03 -0600, Justin Conover wrote:
http://www.citi.umich.edu/u/provos/systrace/linux.html
Anybody, seen/use systrace on FC? What are your thoughts about using/adding it to FC?
From reading a bit about it, looks to be a very good/useful tool and
was wondering what others thought about it?
My opinion is that it is essentially an inferior implementation of much of the functionality SELinux provides. It does have some additional features like the dynamic privilege elevation that seem possibly useful, but I don't think it makes sense to use systrace just for that.
For example, from the "usr_sbin_httpd" policy: (http://www.citi.umich.edu/u/provos/systrace/usr_sbin_httpd):
native-kill: permit
As far as I can tell, this rule permits the "unprivileged" httpd to kill any other process it wants with the same uid, and should the root portion be compromised, any process can be killed. The language just doesn't allow you to express anything more fine-grained like the SELinux TE language does.
On Mon, 17 Jan 2005 22:36:51 EST, Colin Walters said:
My opinion is that it is essentially an inferior implementation of much of the functionality SELinux provides. It does have some additional features like the dynamic privilege elevation that seem possibly useful, but I don't think it makes sense to use systrace just for that.
I admit not having read the Systrace stuff yet. Are there any features that SELinux would benefit from implementing similar functionality?
On Mon, 2005-01-17 at 22:03, Justin Conover wrote:
http://www.citi.umich.edu/u/provos/systrace/linux.html
Anybody, seen/use systrace on FC? What are your thoughts about using/adding it to FC?
From reading a bit about it, looks to be a very good/useful tool and
was wondering what others thought about it?
Providing security via system call interception and making security decisions based on pathnames considered harmful to security; see the Flask paper available from http://www.nsa.gov/selinux/papers/flask-abs.cfm. Sadly, the systrace site acknowledges the Flask paper, but misses the point entirely...
selinux@lists.fedoraproject.org